NVD Vulnerability Detail

CVE-2009-4112

Summary	Cacti 0.8.7e and earlier allows remote authenticated administrators to gain privileges by modifying the "Data Input Method" for the "Linux - Get Memory Usage" setting to contain arbitrary commands.
Publication Date	Dec. 1, 2009, 6:30 a.m.
Registration Date	Jan. 29, 2021, 1:26 p.m.
Last Update	Oct. 11, 2018, 4:48 a.m.

Affected software configurations

Related information, measures and tools

No	URL	refsource	タグ
1	http://archives.neohapsis.com/archives/fulldisclosure/2009-11/0292.html	FULLDISC	Exploit
2	http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html	SUSE
3	http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html	SUSE
4	http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html	SUSE
5	http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html	SUSE
6	http://www.openwall.com/lists/oss-security/2009/11/26/1	MLIST
7	http://www.openwall.com/lists/oss-security/2009/11/30/2	MLIST
8	http://www.securityfocus.com/archive/1/508129/100/0/threaded	BUGTRAQ
9	http://www.securityfocus.com/bid/37137	BID	Exploit
10	https://exchange.xforce.ibmcloud.com/vulnerabilities/54473	XF

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-264	認可・権限・アクセス制御	https://cwe.mitre.org/data/definitions/264.html

JVN Vulnerability Information

Cacti における権限を取得される脆弱性

Title	Cacti における権限を取得される脆弱性
Summary	Cacti には、権限を取得される脆弱性が存在します。
Possible impacts	リモート認証された管理者により、任意のコマンドを含む "Linux の Get Memory 使用" の "データ入力メソッド" を変更されることで、権限を取得される可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Nov. 30, 2009, midnight
Registration Date	June 26, 2012, 4:18 p.m.
Last Update	June 26, 2012, 4:18 p.m.

Affected System

The Cacti Group

Cacti 0.8.7e およびそれ以前

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2009-4112	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4112
National Vulnerability Database (NVD)
2	CVE-2009-4112	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-4112

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-264	https://jvndb.jvn.jp/ja/cwe/CWE-264.html

ベンダー情報

No	Name	URL
Cacti
1	Top Page	http://www.cacti.net/download_cacti.php

Change Log

No	Changed Details	Date of change
0	[2012年06月26日] 掲載	Feb. 17, 2018, 10:37 a.m.